Lucene search
+L

5383 matches found

EUVD
EUVD
•added 2026/08/18 5:26 p.m.•13 views

EUVD-2026-61075

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allowrunas enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/runas endpoint. Attackers can...

7.1CVSS5.4AI score0.00555EPSS
SaveExploits1References3
OSV
OSV
•added 2026/08/18 5:26 p.m.•9 views

CVE-2026-74039 Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allowrunas enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/runas endpoint. Attackers can...

7.1CVSS5.5AI score
SaveExploits0References6
CVE
CVE
•added 2026/08/18 5:26 p.m.•62 views

CVE-2026-74039

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 are vulnerable to CPU-exhaustion DoS. Authenticated attackers with allow_run_as enabled can submit arbitrarily deeply nested auth_context JSON to POST /security/user/authenticate/run_as, causing the API framework to consume excessive CPU and deny service ...

7.1CVSS5.4AI score0.00555EPSS
SaveExploits1References3Affected Software1
RedhatCVE
RedhatCVE
•added 2026/08/18 7:27 a.m.•7 views

CVE-2026-72280

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine for ARM64 architectures. A guest operating system, when operating in a nested virtualization environment, could trigger a hypervisor panic hyppanic by writing to the ZCREL2 system register alias. This issue leads to a denial ...

7.1CVSS5.4AI score0.00186EPSS
SaveExploits0References4
F5 Networks
F5 Networks
•added 2026/08/18 12:10 a.m.•17 views

K000162959: Linux kernel vulnerability CVE-2026-64531

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nlalen field is u16. Commit a1e64addf3ff "net: openvswitch: remove misbehaving...

7.8CVSS5.8AI score0.00189EPSS
SaveExploits2
Tenable Nessus
Tenable Nessus
•added 2026/08/18 12:00 a.m.•21 views

Linux Distros Unpatched Vulnerability : CVE-2026-72287

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into normal checks Move the off-by-default consistency check for vmcs12.tprthreshold vs. the virtual AP...

7.8CVSS5.8AI score0.00141EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/08/18 12:00 a.m.•16 views

PT-2026-77250

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow run as enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/run as endpoint. Attackers can...

7.1CVSS5.4AI score0.00555EPSS
SaveExploits1References4
Tenable Nessus
Tenable Nessus
•added 2026/08/18 12:00 a.m.•12 views

Linux Distros Unpatched Vulnerability : CVE-2026-72280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: nv: Drop bogus WARN for write to ZCREL2 It is entirely possible for a guest to write to the ZCREL2 sysreg alias while in a nested context, as it is...

7.1CVSS5.9AI score0.00186EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
•added 2026/08/18 12:00 a.m.•16 views

Linux Distros Unpatched Vulnerability : CVE-2026-62982

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and...

8.8CVSS5.4AI score0.00197EPSS
SaveExploits1References2
Tenable Nessus
Tenable Nessus
•added 2026/08/18 12:00 a.m.•8 views

Linux Distros Unpatched Vulnerability : CVE-2026-54284

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten...

8.7CVSS5.8AI score0.00332EPSS
SaveExploits0References3
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/08/18 12:00 a.m.•0 views

CVE-2026-74039: Allocation of Resources Without Limits or Throttling

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allowrunas enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/runas endpoint. Attackers can...

7.1CVSS5.9AI score0.00555EPSS
SaveExploits1References7
Positive Technologies
Positive Technologies
•added 2026/08/18 12:00 a.m.•22 views

PT-2026-77214

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively f...

8.7CVSS5.3AI score0.00725EPSS
SaveExploits0References6
Github Security Blog
Github Security Blog
•added 2026/08/17 5:49 p.m.•25 views

sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

Summary sqlparse ships hard limits MAXGROUPINGDEPTH=100, MAXGROUPINGTOKENS=10000 intended to bound parsing work on attacker-supplied SQL, but the path that reaches those limits is itself Ondepth per token-group construction. A 1-2 KB SQL payload e.g. SELECT 1 ... with 500-2000 nesting levels, or ...

8.7CVSS6.1AI score0.00332EPSS
SaveExploits0References3Affected Software1
OSV
OSV
•added 2026/08/17 5:43 p.m.•31 views

CVE-2026-54284 sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU consumption through sqlparse.parse,...

8.7CVSS5.9AI score
SaveExploits0References4
Github Security Blog
Github Security Blog
•added 2026/08/17 5:20 p.m.•16 views

Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Summary CVE-2026-32608 "Command Injection via Process Names in Action Command Templates" was fixed commit 5680a5d by adding sanitizemustachedict, which replaces the shell operators &&, |, , with spaces in the values rendered into action command templates. The sanitizer only processes top-level...

8.8CVSS7.4AI score0.00202EPSS
SaveExploits1References4Affected Software1
OSV
OSV
•added 2026/08/17 5:20 p.m.•10 views

GHSA-73WF-9VMV-5PV9 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Summary CVE-2026-32608 "Command Injection via Process Names in Action Command Templates" was fixed commit 5680a5d by adding sanitizemustachedict, which replaces the shell operators &&, |, , with spaces in the values rendered into action command templates. The sanitizer only processes top-level...

8.8CVSS5.9AI score0.00197EPSS
SaveExploits1References4
EUVD
EUVD
•added 2026/08/17 5:07 p.m.•16 views

EUVD-2026-60303

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

8.8CVSS5.2AI score0.00197EPSS
SaveExploits1References3
Positive Technologies
Positive Technologies
•added 2026/08/17 12:00 a.m.•12 views

PT-2026-73383

Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls...

7.1CVSS5.2AI score0.00451EPSS
SaveExploits0References3
NVD
NVD
•added 2026/08/16 2:16 p.m.•18 views

CVE-2026-74792

Scriban before 7.0.0 affected versions = 6.6.0 contains a stack overflow vulnerability in nested array initializer parsing. Deeply nested array initializers recurse through a path ParseArrayInitializer → ParseExpression → ParseArrayInitializer that is not covered by the ExpressionDepthLimit count...

8.7CVSS0.00527EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
•added 2026/08/16 1:14 p.m.•10 views

CVE-2026-74792 Scriban before 7.0.0 Stack Overflow via nested array initializers

Scriban before 7.0.0 affected versions = 6.6.0 contains a stack overflow vulnerability in nested array initializer parsing. Deeply nested array initializers recurse through a path ParseArrayInitializer → ParseExpression → ParseArrayInitializer that is not covered by the ExpressionDepthLimit count...

8.7CVSS5.4AI score0.00527EPSS
SaveExploits0References2
Rows per page
Query Builder